Art. 26

(Art. 9 and 21 FinIA)

1. Portfolio managers and trustees shall set out guidelines for the basic principles of risk management and define their risk tolerance.
2. Risk management and internal control are not required to be independent of revenue-based activities if the portfolio manager or trustee:
   1. is a company which has five or fewer full-time positions or annual gross earnings of less than CHF 2 million; and
   2. adheres to a non-high-risk business model.
3. The thresholds in accordance with paragraph 2 letter a must be achieved in two of three past business years or be provided for in the business planning.
4. If the portfolio manager or trustee has a body responsible for governance, supervision and control in accordance with Article 23 paragraph 3 and generates annual gross earnings of more than CHF 10 million, FINMA may also require that internal auditors who are independent of management be appointed where the nature and scope of activity so dictate.